Networked applications, such as voice and video, are accelerating the need for instantaneous, branch-interconnected, and Quality of Service—(QoS) enabled Wide Area Networks (WANs). The distributed nature of these applications results in increased demands for scale. Moreover, as network security risks increase and regulatory compliance becomes essential there is a need for transport security and data privacy.
GDOI refers to the Internet Security Association Key Management Protocol (ISAKMP) Domain of Interpretation (DOI) for group key management. In a group management model, the GDOI protocol operates between a group member and a group controller or key server (GCKS), which establishes security associations (SAs) among authorized group members.
Each group member registers with the key server to get the IPsec SA or SAs that are necessary to communicate with the group. The group member provides the group ID to the key server to get the respective policy and keys for this group. These keys are refreshed periodically, and before the current IPsec SAs expire.
The responsibilities of the key server include maintaining the policy and creating and maintaining the keys for the group. When a group member registers, the key server downloads this policy and the keys to the group member. The key server also rekeys the group before existing keys expire.
With GDOI, the key server has to maintain timers to control when to invalidate an old key after rekeying has occurred. Moreover, if one key is compromised then the security of communications to all group members sharing said key is also compromised.